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© Functionally modifiable cable television converter system. 



© A cable television converter with iremotely modi- 
fiable functionality receives firmware downloaded 
over a cable television network. The iintegrity of the 
firmware is verfied and if valid, the ffirmware is ex- 
ecuted to provide one or more converter funtions. If 
the firmware is invalid, default operration software 
contained in ROM is executed instead of the firm- 
ware to return the converter to baseline operation. In 
one embodiment, the converter includies a frequency 
agile data receiver to receive control instructions on 
a first data channel and firmware on a second data 
channel. The receiver is forced baick to the first 
channel if a successful firmware dowinload does not 
^ occur on the second channel within a predetermined 
Q time period. The firmware is continuously transmit- 
§ ted in short segments, and the conv/erter can con- 
Mtinue to receive segments until all the' segments of a 
0) designated firmware package have Ibeen success- 
fully downloaded, unless the predetermined time lim- 
00 it expires sooner. 
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FUNCTIONALLY MODIFIABLE CABLE TELEVISION CONVERTER SYSTEM 



BACKGROUND OF THE INVENTION 

The present invention relates to cable televi- 
sion apparatus, and more particularly to» a converter 
with remotely modifiable functionality provided by 
downloadable firmware. 

Cable television converters are currently avail- 
able that allow a cable system operator to remotely 
control subscriber service authorizations from a 
central "headend" site. These units., which are 
commonly referred to as "addressable converters", 
allow the cable system operator to comtrol access 
to various premium services by sendimg a control 
signal from the headend to individuall converters 
located at subscribers* homes. The authorization 
signals are carried on the cable television system, 
and enable individual subscribers to viesw programs 
that they pay an additional fee for. In operation, the 
control signals typically enable the converter to 
descramble the premium channels for* viewing by 
the subscriber. 

Other addressable systems currently available 
allow a limited set of operational pararmeters to be 
downloaded to a converter from the headend. Such 
operational parameters include, for example, in- 
formation that maps displayed channels to tuned 
channels, time-out periods, barker chamnel (s), the 
converter output channel, the terminal configura- 
tion, and enable/disable functions fotr subscriber 
features such as remote hand-held conttrol, parental 
control, favorite channel recall, volume control, and 
the like. The current state of the art is to download 
configuration information for a set of ffeatures that 
have been predetermined at the time of manufac- 
ture or installation of the cable television converter. 
An example of such a converter is: the Model 
DPV7200 addressable converter manufactured by 
the Jerroid Division of General Instrument Corpora- 
tion, Hatboro, Pennsylvania, U.S.A 

Other systems with downloadable data capabil- 
ities are also known. U.S. Patent 4U)54,911 to 
Fletcher, et al. relates to an informattion retrieval 
system capable of capturing packets, or rows of 
video displayable data and.'or contrrol program 
instructions from data continuously tramsmitted in a 
common predetermined format. In the system dis- 
closed in the patent, a user decides w/hat informa- 
tion is to be retrieved, and takes actiom to cause a 
terminal to retrieve that information. Although a 
user can vary the function of the terminal by cap- 
turing different transmitted data, it is tthe user that 
determines what video displayable infoirmation is to 
be received, and how the terminal whiich receives 
this information is to process it. There is no disclo- 
sure or provision of means to enablle a system 



operator to establish the functional operation of 
individual terminals on a multi-termimal network. 

In commonly owned U.S. Patetnt 4,712,239 to 
Frezza, et al. entitled "Security Arrangement for 
s Downloadable Cable Television Converters", incor- 
porated herein by reference, a downloadable con- 
verter is disclosed that prevents a false booter 
image from being downloaded. A fallse image could 
subject the system to various integrity problems, 
to such as enabling an unauthorized user to view 
premium programs. In the patenited system, a 
booter image is received on one channel and a 
checksum is computed there from. A valid check- 
sum, extracted from tag data transmitted on a 
75 separate channel and associated wiith a scrambled 
program signal, is compared with the computed 
checksum. If the checksums do not match, a de- 
scrambler in the converter is precluded from de- 
scrambling the program signal. Tlhe system dis- 
20 closed in this patent downloads all <of the operating 
software to, a cable television converter over a 
dedicated "booter channel", to which the converter 
is force tuned when first turned on. After the down- 
load is complete, the converter's cdata receiver is 
25 returned to the regular data chanmel, where it re- 
mains until the converter is turned off. 

It would be advantageous to provide a method 
and system for downloading firmware to a remote 
terminal, such as a cable television converter, to 
ao allow modification of virtually any or all firmware 
functions of the terminal by the system operator. It 
would be further advantageous for such a method 
and system to enable the system operator to re- 
place or modify options that were predetermined at 
35 the time of manufacture or installation of the termi- 
nal. By effecting terminal modifications automati- 
cally from a headend location, suclh a method and 
system would eliminate the need fo>r a technician to 
travel to a subscriber's home to modify or phys- 
40 ically replace a subscriber's terminal to effect such 
functional modifications. 

The present invention provides: such a method 
and system for remotely modifying the functionality 
of a cable television converter or otlher terminal. 

45 

SUMMARY OF THE INVENTION 



In accordance with the present invention, a 
cable television converter with rermotely modifiable 
functionality is provided. The comverter includes 
means for receiving firmware downloaded over a 
cable television network, and meanis coupled to the 
receiving means for storing the ffirmware. Means 
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are provided for verifying the integrity/ of the firm- 
ware, and processor means coupled t(0 the storing 
means accesses and executes the firmware to pro- 
vide one or more converter functions: dictated by 
the firmware. Nonvolatile memory meains are coup- 
led to the processor means for storing default 
operation software for the converter;. Means re- 
sponsive to the verifying means cause the proces- 
sor means to execute the default operation soft- 
ware, instead of the downloaded firmware, in the 
event the integrity of the firmware is not verified. 

Data receiving means may be provided for 
obtaining instructions downloaded over a cable 
television network. Downloaded firmware is re- 
ceived and stored by the converter only in re- 
sponse to specific instructions received by the data 
receiving means. 

The firmware receiving means and data receiv- 
ing means can comprise a frequency agile data 
receiver, together with means for selectively tuning 
the receiver, to receive instructions om a first chan- 
nel and downloaded firmware on a second channel. 
Timer means return the receiver to the> first channel 
if the receiver has been tuned to the second chan- 
nel for a predetermined time period. TThe predeter- 
mined time period may be specified im instructions 
received on said first channel, and thei length of the 
time period may be dependent on an amount of 
firmware to be received. In this manner, a con- 
verter will not become stuck on the second channel 
by error, and be rendered unable to rteceive further 
instructions on the first channel. 

The downloaded firmware received and stored 
by the converter can implement a functional layout 
on a keyboard associated with the comverter. Firm- 
ware can also implement a feedback ffunction, such 
as an LED (light-emitting-diode) dhsplay or on- 
screen display to assist a user in (operating the 
converter. A control function for a viideo recorder 
coupled to the converter can also be implemented 
by the firmware. Similarly, the firmwaire can imple- 
ment a communication protocol for th(e converter, a 
descrambling technique for the conwerter, an on- 
screen display to be provided by the (converter to a 
television coupled thereto, and/or a luser interface 
to services provided over the cable ttelevision net- 
work. 

In a preferred embodiment of trne present in- 
vention, firmware is transmitted in an encrypted 
form, and the instructions contain a k©y for decryp- 
ting the firmware. The firmware ma>y also be re- 
ceived by the converter in a plurality of segments, 
with the instructions identifying the niumber of seg- 
ments to be received for a complete firmware 
download. Means can be provided far determining 
if all of the segments have been vallidly received, 
and for receiving replacement segmtents if one or 
more segments of the firmware have not been 



validly received. Receipt of firmware can be pre- 
vented if the number of segments identified by the 
instructions is greater than a predetermined limit. 
Cable television headend apparatus is provided 

5 for downloading firmware to an addressable, re- 
motely modifiable cable televiision converter. 
Means are provided for transmittting addressable 
converter data on a first data channel of a cable 
television network. Means are provided for trans- 

w mitting firmware on a second datia channel of the 
cable television network. An addraess specific to a 
particular converter is provided in the addressable 
converter data, which enables specific data to be 
received by the converter. Instructions are provided 

js in the specific data, to cause tthe converter to 
receive firmware transmitted on tfrie second chan- 
nel. 

The cable television headend apparatus can 
further include means for verifyimg that firmware 

20 downloaded to the converter has been successfully 
received by the converter. Billing: means maintain 
records of the cable television se»rvices each con- 
verter on the system is authorizeod to receive, and 
the various functions the converter is to have, and 

25 can assign a particular firmware* package to be 
downloaded to a particular converter on the basis 
of the functions specified for that converter. 

A method for providing a cab»le television con- 
verter with functions dictated by (downloaded firm- 

30 ware is also provided. Converter control data is 
received from a remote location wia a cable televi- 
sion network. A designated firmware package is 
captured from a set of firmware packages carried 
on the cable television network,, in response to 

35 instructions contained in the converter control data. 
The designated firmware package is stored in a 
memory provided in the converter-, and is executed 
to provide at least one converter function dictated 
thereby. 

40 The firmware packages may !be carried on the 

cable television network in enctrypted form, and 
decrypted using a key contained! in the converter 
control data. In one embodimemt, the converter 
control data is received on a first data channel and 
45 the firmware packages are captured from a second 
data channel on the cable television network. The 
first channel is monitored to receiive converter con- 
trol data, and the second channel is tuned to cap- 
ture firmware upon receipt of appropriate instruc- 

50 tions on the first channel. Recepttion is returned to 
the first channel after the firmware is captured. If 
the firmware has not been captured within a pre- 
determined time period, reception! switched back to 
the first channel from the second channel. 

55 Also in accordance with the present invention, 

a remotely modifiable user terrminal is provided 
which comprises means for receiiving a plurality of 
cyclically transmitted firmware segments, the seg- 
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merits together comprising a firmwarre package. 
Means coupled to the receiving means; verify each 
segment upon receipt thereof, and means are pro- 
vided for storing each verified segmemt. A deter- 
mination is made as to whether a cormplete firm- 
ware package has been stored in the storing 
means at the completion of a firmware transmission 
cycle, if not, then reception, verification, and stor- 
age of transmitted firmware segments continues 
during a subsequent firmware transmission cycle. 
Reception of the firmware segments is terminated 
upon a finding that a complete firmware package 
has been stored. Means can further be provided for 
precluding the execution of firmware segments un- 
til a complete firmware package has beten stored. 

The verifying means can operate Iby testing a 
checksum for each firmware segment as it is re- 
ceived. The terminal may further comprise means 
for maintaining a record of the proper clhecksum for 
each segment and means for periodically retesting 
the checksums after a complete firmwiare package 
has bean stored. Default operation software may be 
stored for the terminal, and executed iif the check- 
sums are not verified upon retesting. TJhe complete 
firmware package may also be verified! after it has 
been stored, and the default operation software 
executed if the complete firmware package is not 
valid. The default operation software rmay also be 
executed if reception of firmware segments is not 
completed during a predetermined time* period. 

A complete firmware package may include a 
plurality of modules. Execution of fewer than all of 
the modules may be precluded as an additional 
security feature. 

BRIEF DESCRIPTION OF THE DRAWINGS 

Figure 1 is a block diagram of a functionally 
modifiable cable television converter system in ac- 
cordance with the present invention; 

Figure 2 is a block diagram of tthe pertinent 
elements of a converter used in connection with 
the system of the present invention; 

Figure 3 is a flowchart illustrating steps tak- 
en by the headend when it receives a new firm- 
ware package or an assignment to download firm- 
ware to a converter; 

Figure 4 is a flowchart illustrating the con- 
tinuous transmission of firmware over ;a secondary 
data channel; 

Figure 5 is a flowchart illustrating the steps 
taken by a converter in receiving downloaded firm- 
ware; and 

Figure 6 is a flowchart illustrating the peri- 
odic reverification of downloaded software by a 
converter. 



DETAILED DESCRIPTION OF THE INVENTION 



Turning to Figure 1, a cable television system 
s is depicted having headend components, generally 
designated 10 and subscriber cormponents, gen- 
erally designated 12. The headend! communicates 
with the subscriber via a distributiion cable 36. A 
firmware development system 16 is used to create 
70 new functional firmware packages: for subscriber 
terminals, such as converter 40. Firmware develop- 
ment system 16 may be physically located at the 
headend, but is more typically locatted at the facili- 
ties of a vendor which develops: new firmware 
is programs for sale to a cable systerm operator. New 
firmware packages may be transferred to an ad- 
dressable controller 14 located at tthe headend by 
magnetic tape 20 which is read lby addressable 
controller 14, or by communicaticon between the 
20 firmware development system 16 and addressable 
controller 14 via direct connection or modems 18 
operating over conventional telephome lines. Those 
skilled in the art will recognize thiat other means 
may also be available for transferring firmware from 
25 firmware development system 16 to addressable 
controller 14. 

Once firmware is resident in addressable con- 
troller 14, it is transmitted repeatedly over a data 
channel. The data channel may be either the pri- 
30 mary addressable data channel provided in a con- 
ventional cable television network having addres- 
sable converters, or a separate secondary data 
channel. In either event, the data channel<s> can 
transmit the data on an FSK modullated FM carrier 
as or by any other suitable transmission scheme well 
known in the art. 

The use of a secondary channel for down- 
loading firmware to converters is illlustrated in Fig- 
ure 1. Control signals, including data such as con- 
40 verter addresses, program authorization codes, and 
the like is communicated from addressable control- 
ler 14 to a converter 40 via controll data modulator 
26. The output of control data modulator 26 is 
coupled to distribution cable 36 viia a tap 34, and 
45 data is received therefrom by conwerter 40 via tap 
38. The control data modulator transmits the data 
signals on a primary channel, and in accordance 
with the present invention, the data includes 
instructions to converter 40 which cause the con- 
so verter to receive specified firmware downloaded 
from addressable controller 14. 

In the two channel embodiment illustrated in 
Figure 1. the firmware is transmittted on a secon- 
dary channel by firmware modulator 24, coupled to 
55 the cable network at tap 30. Upon receipt of 
instructions on the primary channel, converter 40 
switches to the secondary channel for receipt of 
designated firmware. An additional data path 28 
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may optionally be provided via tap 32 for receipt of 
data from converter 40 by addressable controller 
14. Such data might include, for example, a ver- 
ification that converter 40 has successfully received 
a firmware package it has been insttructed to re- 
ceive. The provision of a return patth 28. which 
provides a "two-way" cable commuinication sys- 
tem, is well known in the art. 

Billing system 22 is provided at the headend 
for maintaining accounting information relating to 
charges incurred by subscribers on tlhe cable sys- 
tem, in accordance with the present iinvention, dif- 
ferent firmware packages downloaded! by headend 
10 to converter 40 may provide different converter 
functions, with higher levels of service providing 
increased converter functionality. Billimg system 22 
keeps track of the level or service ffor.each sub- 
scriber, and assigns particular firmware packages 
to subscriber converters on the basis* of converter 
functionality to be provided to each subscriber. 

At the subscriber location 12, a subscriber may 
have one or more video appliances 412, 44 coupled 
to the output of converter 40. For example, video 
appliance 42 might be a television sset, and video 
appliance 44 might be a video recorder ("VCR"). In 
accordance with the present inventtion, firmware 
downloaded to converter 40 can prowide functions 
relating to a VCR. An example of suclh a function is 
time controlled programming. This function enables 
the converter to be programmed to rmake channel 
changes at various times so that tthe VCR can 
record different television programs; on different 
channels automatically and while unattended. Such 
a function can also enable "impulse ipay-per-view" 
orders to be programmed into the ctonverter by a 
subscriber, so that special premium iprograms can 
be ordered, when the subscriber is mot home, and 
recorded on the subscriber's VCR for later viewing. 

Figure 2 is a block diagram illustrating the 
pertinent components in one embodiment of a con- 
verter 40 in accordance with the present invention, 
in the embodiment illustrated, the converter re- 
ceives addressable data on one data channel and 
downloaded firmware on another data channel. It is 
noted that in another embodiment of the invention, 
both the addressable data and the firrmware can be 
received over a single data channel.. Or, the firm- 
ware may be carried on some other rmedia, such as 
the public telephone network. 

In the two channel embodimentt illustrated in 
Figure 2, a microprocessor 50 receiives data from 
cable 36 via a frequency agile receiver 52. A 
transmitter 61 and return path 62 cam be provided 
from microprocessor 50 back to addressable con- 
troller 14 in the event the converter is used with a 
two-way cable television system. Litae receiver 52, 
transmitter 61 can be frequency agilie to enable a 
choice of return transmission frequencies. 



A tuner 54, under the control of microprocessor 
50, tunes frequency agile receiver 52 to either a 
primary channel for receipt of addressable data 
(e.g., instructions to capture a particular firmware 

s package) or to a secondary channel for the receipt 
of firmware. Although a single secondary channel is 
described herein for purposes of illustration, it will 
be appreciated that any number of such secondary 
channels can be provided, depeinding on system 

io requirements. Typically, frequency agile receiver 
will be tuned to the primary channel, and will only 
switch to the secondary channel upon specific 
instructions contained in data received on the first 
channel. In the alternate emboditment where both 

75 addressable data and firmware aire received on a 
single data channel, frequency agile receiver 52 
and tuner 54 can be replaced with a fixed fre- 
quency data receiver. 

The provision of a dedicated secondary date 

20 channel as illustrated in Figure 2 is advantageous. 
By keeping firmware data off of tthe primary chan- 
nel, the data throughput load orn this channel is 
reduced. 

In the two channel embodiment, firmware data 
25 is broadcast cyclically on the second channel, by 
addressable controller 14 at the headend. In a 
preferred embodiment, a plurality of different firm- 
ware packages are broadcast an the secondary 
channel, each package providing different convert- 
so er functions or combinations off functions. Upon 
receipt of instructions on the primary channel, 
microprocessor 50 will cau(e tumer 54 to switch 
receiver 52 to the secondary chainnel for receipt of 
a designated firmware package. 
35 Various memory devices are coupled to micro- 

processor 50, including read only memory 
("ROM") 56, operating random access memory 
("RAM") 58. and nonvolatile firrmware RAM 60. 
ROM 56 contains a program thait allows converter 
40 40 to retrieve and execute a downloaded firmware 
package. Upon receiving the propoer command from 
the addressable controller, the converter aborts any 
downloaded package currently being executed, ac- 
cesses the appropriate data chaninel for receipt of a 
45 designated firmware package to be downloaded, 
and receives and loads the fiirmware into non- 
volatile firmware RAM 60. 

ROM 56 also contains defaiult operation soft- 
ware, which is used to restore tthe converter to a 
so nominal or "baseline" operation if a bad firmware 
download occurs. As explained below, if an error is 
detected in the receipt of downloaded firmware, or 
if the firmware is found to be inwalid. the converter 
is forced to execute only the default operation 
55 software stored in ROM 56. 

A timer 64 is associated wiith microprocessor 
50 to provide a time-out feature that prevents the 
converter from getting stuck on the secondary 
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channel, in the event there is a problesm receiving 
specified firmware. 

When billing system 22 assigns sa new firm- 
ware package to a particular converter 40, addres- 
sable controller 14 is commanded to transmit 
instructions to the converter. The instructions are 
received by microprocessor 50. and include an 
identifier specifying which firmware package to re- 
ceive, where to find the firmware package (i.e., on 
the primary or a specified secondary channel), a 
predetermined time limit defining how long the 
converter should attempt to receive tlhe firmware 
before aborting, a key to use in decrypting the data 
in the event it is encrypted, and the maximum 
segment number to be loaded (indiicating how 
many segments are included in the firrmware pack- 
age to be received). While the firmware is being 
received, timer 64 counts down the timte-out period 
specified in the download command. If the timer 
expires, microprocessor 50 aborts the download, 
and returns to the original data channel. The time- 
out period specified in the download command can 
be varied depending on the amount of firmware to 
be downloaded. 

Timer 64 is also used in connectiom with a self- 
check that is periodically performed toy the con- 
verter to ensure that the firmware has mot changed 
since the last authorized download. Thiis self-check 
is a security feature to guard against iinfiltration of 
the converter by a "software pirate" wtho attempts 
to download unauthorized software to thie converter, 
in an effort to steal services from the caible system. 

In accordance with the self-check: procedure, 
timer 64 retests the checksum for each of the 
firmware segments at regular intervalls after the 
firmware has been downloaded. In tthe event a 
checksum is found to be invalid, microprocessor 50 
restores the converter to baseline operation by 
executing the default operation software contained 
in ROM 56. 

Converter 40 contains various otlher compo- 
nents with functions that can be modified by down- 
loaded firmware. For example, a light:-emitting-di- 
ode ("LED") display or other display 66 may be 
provided on the converter to give a uster feedback 
concerning converter operations. Pressiing a button 
on the converter, or its remote control unit, can 
cause an LED to light, verifying that the button has 
been pressed or that a function to be activated by 
the button has occurred. Such a feedback function 
is useful to assist a user in operating thee converter. 

The converter also includes a keybioard 68. the 
functional layout of which can be deffined and/or 
modified by firmware downloaded to thte converter. 
Keyboard 68 may be physically on thte converter 
box, on a remote hand-held unit for true converter, 
or a separate keyboard can be provided in both 
places. 



Converter 40 also includes a (descrambler 70 
for descrambling premium prograrms received via 
the cable television network. Various descrambling 
techniques are well known in the airt, and different 

s techniques can be implemented toy downloading 
different firmware to the converter. 

Another feature that can be provided by con- 
verter 40 is the display of information on a user's 
television set. On-screen display diriver 72 is pro- 

iq vided for this purpose. An examiple of such a 
display is the channel number turned to. or the 
current time. In addition, on-screen (displays can be 
used to distribute messages from thie cable system 
operator, e.g., "your account is past due; please 

75 send us a check". An electronic mtail. or "E-mail" 
feature can also be provided, enabliing a subscriber 
to send and receive text messages on his televi- 
sion (or other display) via the cabUe system. The 
implementation and/or modification of on-screen 

20 displays can be provided by firmware downloaded 
to the converter. 

In order to provide a measune of protection 
against illegal use of the firmware > download fea- 
ture, the firmware is downloaded to ithe converter in 

25 an encrypted form. The data is decrypted at the 
converter by a decryption module 7*4. A decryption 
key is transmitted to the converter from the 
headend as part of the addressabile data instruc- 
tions that command the converLejr to receive a 

30 particular firmware package. Encryption and de- 
cryption schemes are well known inn the art. Exam- 
ples of such schemes are providetd in commonly 
owned U.S. Patent Nos. 4.638.35© of William A. 
Frezza. entitled "Apparatus and Method for Re- 

35 striding Access to a Communication! Network", and 
4,710.955 of Marc W. Kauffman, entitled "Cable 
Television System with Two-Way Telephone Com- 
munication Path". Both of these patterns are incor- 
porated herein by reference. 

40 A viewership monitor 76 can be provided in 

accordance with the present invention to enable a 
cable system operator to determine* what programs 
and services a subscriber has receiived using each 
converter, and/or to retrieve a list tof the functions 

45 which have been used on each comverter. Viewer- 
ship monitor 76 will monitor the operation of the 
converter, and store pertinent data \ relating thereto. 
By addressing an appropriate command to the 
converter, the cable system operator will be able to 

so upload the data to the headend for analysis. 

Other functions that can be implemented by 
firmware downloaded to the converter include com- 
munication protocols for the converter, and user 
interfaces to services provided overr the cable tele- 
55 vision network. For example, a user may be pro- 
vided with the capability to order pay-per-view pro- 
grams on an impulse basis. The* procedure for 
ordering such programs can be rrnodified through 
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downloadable firmware. Utility meter reading can 
also be provided, by adding an asynchronous data 
port to the converter and controlling trne retrieval of 
utility data via downloaded firmware. 

A flowchart illustrating a routine which can be 
used by the addressable controller iin connection 
with the receipt and downloading off firmware is 
provided in Figure 3. The routine begiins at box 80, 
and at box 82 a determination is made as to 
whether a firmware update has been received from 
the firmware development system, lif so, control 
passes to box 84 and the new firmware data is 
encrypted. At box 86, the encrypted dlata is loaded 
into the secondary data channell transmitter 
(firmware modulator 24) and continuously transmit- 
ted on the secondary channel together with other 
firmware packages that can be provided to convert- 
ers on the system. 

At box 88, a determination is made as to 
whether a new firmware package assignment has 
been made by billing system 22. If so», addressable 
controller 14 sends an appropriate (command on 
the primary channel (control data modulator 26) as 
indicated at box 90. The command is addressed to 
the particular converter that is to receive the firm- 
ware, and identifies the channel the ffirmware is to 
be received from, identifies the firmware package 
to be received, provides the decryption key neces- 
sary to decrypt the firmware data, identifies the 
number of segments which make up the complete 
firmware package, and sets forth thei time-out pa- 
rameter defining the maximum time the converter 
should stay tuned to the secondary^ channel for 
receipt of the downloaded firmware. 

The converter receives the firmware in fixed 
length "segments", and specific converter models 
will have specific maximum segment numbers de- 
termining the actual maximum size of allowable 
firmware downloads, in a preferred embodiment, 
the maximum segment number is ?a hard-coded 
parameter. Should an attempt be miade to down- 
load firmware that exceeds the maxirmum size, the 
download will be rejected by the cornverter. In op- 
eration, the converter will ignore tthe download 
command and will not switch to tlhe secondary 
channel if the transmitted maximum segment num- 
ber parameter exceeds the internal converter maxi- 
mum. 

At box 92 of Figure 3, a determination is made 
as to whether an abort of a downloaid is required. 
This would be the case, for example, if the addres- 
sable controller detects a problem witth an attempt- 
ed download. In the event an abort is required, an 
abort command is transmitted over tthe secondary 
channel as indicated at box 94. The converter will 
then switch back to the primary channel, execute 
the default operation software to return to a 
baseline operation, and await a subsequent com- 



mand from the addressable controller via the pri- 
mary data channel. At box 96, the* routine of Figure 
3 ends. It will be appreciated by trnose skilled in the 
art that the routine of Figure 3 is called on a 
5 periodic basis (or can be a comtinuous loop) to 
enable new firmware to be received from the firm- 
ware development system and t<o download firm- 
ware packages to converters at the command of 
billing system 22. 
ro Figure 4 illustrates a routine that the addres- 

sable controller can use to continuously transmit 
firmware data over the secondary channel. The 
routine commences at box 100, and at box 102 
data is transmitted over the secomdary channel. At 
is box 104, a determination is made as to whether the 
last segment of a firmware patckage has been 
transmitted. If not, transmission of the remaining 
segments continues as indicated ;at box 102. Once 
the last segment has been transmitted, control 
20 passes to box 106 and the addressable controller 
transmits a check/execute command to the 
converter(s) that was to receive the firmware pack- 
age. The check/execute command includes the fir- 
mware package number that was to be received, 
25 and a check pattern. The check pattern is used to 
verify the entire download prior to> execution. When 
a check/execute command is received, the con- 
verter checks to see if all require*! segments have 
been received, and that the cheick pattern down- 
30 loaded matches the pattern calculated from the 
actual downloaded data. If all cheecks are valid, the 
converter permits execution of the downloaded 
code, and returns to the primary data channel. 
After the check/execute commarnd is sent at box 
35 106 of Figure 4, control returns to box 102, and 
continuous transmission of the data proceeds over 
the secondary channel. 

Figure 5 is a flowchart illustrating the capture 
of downloaded firmware by a converter. The rou- 
40 tine begins at box 110, and conttrol passes to box 
112 where a determination is made as to whether a 
firmware capture command has been sent to the 
converter. If not, the converter continuously waits 
for such a command to be received at box 1 12. 
45 Once a firmware capture corrnmand is received, 

control passes from box 112 to> box 120 for the 
actual capture of the firmware. At the same time, 
an ancillary time-out process commences as in- 
dicated at boxes 114, 116. and 1*18. A timer counts 
so down the time-out period specified in the firmware 
capture command. If the time-oout period expires 
before the specified firmware package has been 
successfully captured, as deterrmined at box 114, 
control passes to box 116 wheree the download is 
S5 aborted and the converter returms to the primary 
data channel. As indicated at bcox 118, the default 
operation software is executed so that the con- 
verter can operate in a baselime mode until the 
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appropriate firmware package can toe properly 
downloaded. 

As indicated at box 120. before a firmware 
download commences, a determination! is made as 
to whether the number of segments (contained in 
the firmware package to be downloaded is within 
bounds. In other words, as noted above, the maxi- 
mum segment number of the firmware* package to 
be downloaded must not exceed the m;aximum size 
allowable for the converter. If the nurmber of seg- 
ments exceeds the number allowed Iby the con- 
verter, the firmware capture command is ignored 
and control returns to box 112. Otherwise, the 
firmware capture proceeds and at btox 122. the 
converter switches to the secondary channel (i.e., 
the channel on which the firmware is downloaded). 
At box 124, the segments comprising the firmware 
package are received. Firmware is ■ continuously 
broadcast on the secondary data channel in small 
(e.g., 32 byte) encrypted packets. A converter that 
has been commanded to accept a mew package 
tunes to the appropriate channel andl loads each 
packet that has the proper version identifier. While 
loading, the converter keeps track of each segment 
successfully loaded in an internal segment bit map. 
As indicated at box 126. a determinattion is made 
as to whether a segment has been successfully 
loaded. This is accomplished by computing a 
checksum for each segment, and comparing the 
checksum with one downloaded with ithe firmware 
segment If the checksums match, tine converter 
decrypts the data contained in the segiment stores 
the data, and sets an appropriate bit im a firmware 
segment bit map as indicated at box 1 30. In storing 
the data, if prior firmware has been stored in the 
converter, the appropriate segment >of the prior 
firmware is overwritten with the newly received 
data. 

If it is determined at box 126 thait a segment 
has not been properly loaded (i.e.. thie computed 
and downloaded checksums do not match), the 
converter ignores the segment and (proceeds di- 
rectly to box 132. At box 132, a determination is 
made as to whether the last segment iin a firmware 
package has been received. If not, control returns 
to box 124 and the procedure contirnues until all 
segments are received. 

After the last segment has been received, con- 
trol passes to box 134 which determimes if the bit 
map created at box 130 is complete. Itf the bit map 
is not complete, it means that one or more seg- 
ments were not properly loaded and an attempt to 
receive these segments will be madee during the 
next transmission cycle of the firmware. In this 
event, control returns from box 132 to box 124 
where an attempt to receive the enttire firmware 
package will again be made. 

As is evident from the flowchart of : Figure 5. an 



incorrectly received segment will mot overwrite a 
previously correctly received segment. All correctly 
received segments, however, will overwrite pre- 
viously received segments. In this imanner. even if 
5 there are errors in the transmissioni of certain seg- 
ments during a download cycle, all oof the segments 
should be correctly received after thie completion of 
several complete transmission cycles of a firmware 
package. 

10 Once all of the segments have been properly 

received, the bit map will be complete, and box 
134 will pass control to box 136. Box 136 responds 
to the check-execute command transmitted by the 
addressable controller at box 1016 in Figure 4. 
is When the check,execute command is received, the 
converter checks to see if all required segments 
have been received and that the check pattern 
downloaded matches a pattern calculated from the 
actual downloaded data (i.e.. the complete firmware 
20 package). If the patterns do not match, control 
returns to box 124 and additional attempts are 
made to receive the firmware as long as a time-out 
(box 114) has not occurred. 

If the entire firmware package its determined to 
25 be valid at box 136, control passes to box 138 and 
an execution bit is set permitting th© firmware to be 
executed. As an additional leveil of protection 
against a software pirate, software (contained in the 
converter's ROM (ROM 56 - Figure 2) can periodi- 
30 cally determine if all of the functional modules 
contained in the firmware package are being ex- 
ecuted, and if not. subsequent execution of the 
firmware can be precluded by turming off a sepa- 
rate, special execution bit maintairned by the con- 
as verter. 

At box 140. the downloadingi of a firmware 
package is complete, and the conwerter returns to 
the primary data channel. The routtine ends at box 
142. 

40 The firmware download process is a destruc- 

tive one. Once a converter receives the command 
to accept a new package, the cold downloaded 
firmware (if any) is effectively deleted and cannot 
be executed. In the preferred embodiment, partial 
45 downloads are not supported, and an entire pack- 
age must be sent. This further frustrates a software 
pirate's efforts, and allows a firmware download to 
be nullified by sending the command to accept a 
package immediately followed by stending the corn- 
so mand to return to the primary data channel. 

The various commands sent by the addres- 
sable controller to support the firmware download 
process are: 

Accept Firmware Download 
ss Return to Primary Channel 

Disallow Downloaded Execution 
Load Firmware Segment 
Check/Execute Firmware 
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Send Firmware Check Pattern 

The "Accept Firmware Download"' command is 
used to initiate the firmware downloaid process. It 
may be sent to one individual converter or globally 
to a set of converters that understand a group 
address. The addressed converter(s)i prepares to 
accept the package number, on the appropriate 
channel, using the given firmware decryption key 
and maximum segment number. TThe firmware 
download time-out value is also given., Upon recep- 
tion of this command, the converter goes into its 
firmware download mode, in which it must not 
execute any downloaded code. 

The "Return to Primary Channel" command is 
used to force a converter to return to the primary 
data channel. This command may also be sent in a 
specific format to an individual comverter, or in 
group format to a set of converters. All converters 
receiving this command abort the currrent firmware 
download, clear their firmware segment bit maps, 
and exit the firmware download mode. 

The "Disallow Dowloaded Execution" com- 
mand explicitly disallows the execution of any 
downloaded firmware. It may be sent iin the specific 
or group format. All converters receiviing this com- 
mand abort execution of any downloaded firmware, 
clear their firmware segment bit maps, exit firm- 
ware download mode, and execute thie default op- 
eration software contained in ROM for baseline 
operation. Another method of prohibitiing download- 
ed firmware from being executed is to send an 
"Accept Firmware Download" commiand immedi- 
ately followed by a "Return to Prim;ary Channel" 
command. 

The "Load Firmware Segment" command is 
used to download the individual segments of a 
firmware package. All converters receiving this 
command, if in firmware reception mode, overwrite 
the appropriate segment of firmware by the re- 
ceived data. Before actually overwriting the code, 
the converter checks to see if the package number 
matches the commanded package number, and 
calculates the segment check pattern) from the re- 
ceived data. If the check pattern is; correct, the 
segment data is decrypted, the appropriate prior 
segment is overwritten with the new tsegment. and 
the appropriate bit in the firmware segment bit map 
is set. 

The "Check/Execute Firmware" command is 
used to terminate the firmware download process. 
All converters receiving this commiand respond 
only if the package number matches the one sent 
originally in the "Accept Firmware Download" com- 
mand, and if in firmware reception mode. If so, the 
converter checks to see if all of trhe necessary 
segments of firmware have been correctly re- 
ceived. If they have been, the package check pat- 
tern is calculated and tested. If the crneck pattern is 



bad, the converter ignores the (command. If the 
check pattern is good, the converter permits execu- 
tion of the newly downloaded p;ackage, switches 
back to the primary data stream, exits the firmware 

5 download mode, and clears its firrmware download 
segment bit map. 

The "Send Firmware Check P.'attern" command 
is used to verify the firmware download process. A 
converter receiving this commandl responds only if 

to it is not in firmware reception moide. In this event, 
the converter reports the check pattern of the ap- 
propriate segment or of the entiire package. This 
verification scheme is only available on a two-way 
cable system. 

75 Figure 6 illustrates a periodic self-check routine 

used by the converter to test the validity of down- 
loaded firmware to ensure that it has not changed 
since the last download. This s<eif-check is per- 
formed by the converter itself, ancd no addressable 
20 controller command is required tto initiate it. The 
routine begins at box 150. At box 152. a clock runs 
to keep track of time. At box 154t, a determination 
is made as to whether a predetermined time inter- 
val has passed. If not. the routine loops back to 
25 box 152 and the process continues until the time 
interval has run. Then, box 154 (passes control to 
box 156 to commence the periodic self-check. 

At box 156, the first segmemt of the firmware 
package is tested by computing its checksum. At 
30 box 158, a determination is made as to whether the 
checksum is the proper checksum for that seg- 
ment. If not, control passes to tbox 160 and the 
default operation software is execiuted to return the 
converter to baseline operation. If the checksum for 
36 the segment is proper, control passes to box 162. 
which determines if the segment just tested is the 
last segment in the firmware package. If not. the 
routine loops back to box 156 so that all of the 
segments in the firmware package can be tested. 
4 o Once the last segment has be&en tested, control 

is passed from box 162 to box 16i4 where the clock 
is reset. Control then loops backc to box 152 and 
the process continues, so that tine self-check will 
be periodically performed at the time interval dic- 
45 tated by the time-out determination function at box 
154. 

It will now be appreciated that the present 
invention provides a method aind apparatus for 
remotely modifying the functionality of a terminal, 

so such as a cable television converter. Terminal func- 
tions are dictated by downloaded firmware. The 
firmware is transmitted in small segments to re- 
duce the likelihood and severity of transmission 
errors, and to reduce the temporary buffering re- 

55 quirements within the terminal. Each section of a 
firmware package is transmitted with an identifier 
indicating which segment it is, and which firmware 
package it is part of. A multiplicity of firmware 
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packages may be carried on a single :system, with 
different terminals in the system accepting and 
executing different packages as specified by the 
system headend. 

The firmware is stored at the terrtninal in non- 
volatile memory, such as RAM with a battery bac- 
kup. Various safeguards are providetd to ensure 
that the firmware is accurately downloaded, and to 
frustrate the efforts of a software piratte attempting 
to infiltrate the system. 

Although the present invention has been de- 
scribed in connection with a preferred (embodiment, 
it will be appreciated that many modilfications and 
adaptations may be made thereto without departing 
from the spirit and scope of the invention as set 
forth in the following claims. 



Claims 

1. A cable television converter with remotely 
modifiable functionality comprising: 

means for receiving firmware downloaded from a 
cable television headend; 

means coupled to said receiving meams for storing 
said firmware; 

means for verifying the integrity of saicd firmware; 
processor means coupled to said storiing means for 
accessing and executing said firmwaire to provide 
one or more converter functions dicttated by the 
firmware; 

nonvolatile memory means coupled to^ said proces-- 
sor means for storing default operation! software for 
said converter; and 

means responsive to said verifying means for caus- 
ing said processor means to execute* said default 
operation software instead of said firrmware in the 
event the integrity of said firmware is mot verified. 

2. The converter of claim 1 further comprising: 
data receiving means for obtainingi instructions 
downloaded from a cable television headend; and 
means for enabling downloaded firrmware to be 
received and stored by the converter only in re- 
sponse to specific instructions receiived by said 
data receiving means. 

3. The converter of claim 2 wherein said firm- 
ware receiving means and data receiving means 
comprise: 

a frequency agile data receiver; and 
means for selectively tuning said retceiver to re- 
ceive said instructions on a first chamnel and said 
firmware on a second channel. 

4. The converter of claim 3 further* comprising: 
timer means for returning said receiver to said first 
channel if it has been tuned to said seicond channel 
for a predetermined time period. 

5. The converter of claim 4 wherrein said pre- 
determined time period is specified iin instructions 



received on said first channel. 

6. The converter of claim 5 whnerein the length 
of said predetermined time period iis dependent on 
an amount of firmware to be received . 
5 7. The converter as defined in -one of claims 1- 

6 wherein said firmware implements a functional 
layout on a keyboard associated with said con- 
verter. 

8. The converter as defined in .one of claims 1- 
w 7 wherein said firmware impleme&nts a feedback 

function to assist a user in operating the converter. 

9. The converter as defined in .one of claims 1- 
8 wherein said firmware implements a control func- 
tion for a video recorder coupled to* the converter. 

rs 10. The converter as defined iin one of claims 

1-9 wherein said firmware implerments a commu- 
nication protocol for the converter. 

1 1 . The converter as defined iin one of claims 
1-10 wherein said firmware implements a descram- 

20 bling technique for the converter. 

12. The converter as defined iin one of claims 
1-11 wherein said firmware impllements an on- 
screen display to be provided by trhe converter to a 
television coupled thereto. 

25 13. The converter as defined iin one of claims 

1-12 wherein said firmware implements a user in- 
terface to services provided over a cable television 
network. 

14. The converter as defined iin one of claims 
30 1-13 wherein said firmware implements an elec- 
tronic mail capability to be providled over a cable 
television network. 

15. The converter as defined in one of claims 

1- 14 wherein said firmware implements a viewer- 
35 ship monitoring function. 

16. The converter as defined in one of claims 

2- 15 wherein said firmware is transmitted in an 
encrypted form, and said instructions contain a key 
for decrypting the firmware. 

40 17. The converter as defined in one of claims 

2-16 wherein said firmware is receiived in a plurality 
of segments, and said instructions identify the 
number of segments to be received for a complete 
firmware download. 

45 18. The converter of claim 17' further compris- 

ing: 

means for determining if all of sai<ri segments have 
been validly received; and 

means for receiving replacement segments if one 
so or more segments of said firmware has not been 
validly received. 

19. The converter as defined in one of claims 
17 or 18 further comprising: 

means for preventing the receipt <of firmware if the 
55 number of segments identified by said instructions 
is greater than a predetermined lirmit. 

20. A cable television convertter with remotely 
modifiable functionality comprising!: 
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frequency agile data receiver means for receipt of 
addressable data from a cable television headend 
on a first channel and for receipt of firmware from 
said headend on a second channel; 
means for tuning said receiver means to said sec- 
ond channel for receipt of firmware in response to 
instructions contained in addressable <data received 
on said first channel; 

memory means for storing firmware received on 
said second channel; and 

processor means coupled to said memory means 
for accessing and executing firmware received 
from said headend to provide at least one con- 
verter function. 

21. The converter of claim 20 further compris- 
ing: 

means for verifying the integrity of firmware re- 
ceived on said second channel; and 
means for causing said processor rmeans to ex- 
ecute default operation software insstead of said 
firmware in the event the integrity of :said firmware 
is not verified. 

22. The converter as defined in cone of claims 
or 21 further comprising: 

timer means for returning said receiver to said first 
channel if it has been tuned to said seroond channel 
for a predetermined time period. 

23. The converter of claim 22 wherein said 
predetermined time period is specified in instruc- 
tions contained in addressable data, received on 
said first channel. 

24. The converter as defined in rone of claims - 
22 or 23 wherein the length of said predetermined 
time period is dependent on the armount of firm- 
ware to be received. 

25. The converter as defined in rone of claims 
20-24 wherein said firmware implements a func- 
tional layout on a keyboard associated with said 
converter. 

26. The converter as defined in rone of claims 
20-24 wherein said firmware implements a feed- 
back function to assist a user in (operating the 
converter. 

27. The converter as defined in rone of claims 
20-24 wherein said firmware implements a control 
function for a video recorder coupled to the con- 
verter. 

28. The converter as defined in rone of claims 
20-24 wherein said firmware implements a commu- 
nication protocol for the converter. 

29. The converter as defined in rone of claims 
20-24 wherein said firmware implements a de- 
scrambling technique for the converter. 

30. The converter as defined in rone of claims 
20-24 wherein said firmware implerments an on- 
screen display to be provided by the .converter to a 
television coupled thereto. 

31. The converter as defined in rone of claims 



20-24 wherein said firmware implements a user 
interface to services provided over a cable televi- 
sion network. 

32. The converter as defined in one of claims 
s 20-24 wherein said firmware impilements an elec- 
tronic mail capability to be provided over a cable 
television network. 

33. The converter as defined in one of claims 
20-24 wherein said firmware implements a viewer- 

io ship monitoring function. 

34. Cable television headenid apparatus for 
downloading firmware to an addressable remotely 
modifiable cable television converter, comprising: 
means for transmitting addressable converter data 

is on a first data channel of a cabde television net- 
work; 

means for transmitting firmware con a second data 

channel of said cable television network; 

means for providing an address: in said addres- 

20 sable converter data specific to a particular con- 
verter coupled to the network, said address en- 
abling specific data to be received by said con- 
verter on said first data channel; arnd 
means for providing instructions in said specific 

25 data, said instructions causing said converter to 
receive firmware transmitted on s;aid second chan- 
nel. 

35. The apparatus of claim 34 further compris- 
ing: 

30 means for verifying that firmware downloaded to 
said converter has been successfully received by 
the converter. 

36. The apparatus as definedl in one of claims 
34 or 35 further comprising: 

35 billing means for maintaining a record of functions 
said converter is authorized to have, and for as- 
signing a particular firmware package to be down- 
loaded to said converter on the basis of the au- 
thorized functions. 

40 37. A method for providing a cable television 

converter with functions dictated! by downloaded 
firmware, comprising the steps of:: 
receiving converter control data from 3 remote 
headend location; 

45 capturing a designated firmware package, from a 
set of firmware packages transmitted from said 
remote headend location, in resfponse to instruc- 
tions contained in said converter control data; 
storing the designated firmware package in a mem- 

so ory provided in said converter; and 

executing said firmware to prowide at least one 
converter function dictated thereby. 

38. The method of claim 37 wherein the firm- 
ware packages are transmitted im encrypted form, 

55 said method comprising the further step of: 

decrypting the captured firmware^ using a key con- 
tained in said converter control data. 

39. The method as defined im one of claims 37 
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or 38 wherein said converter control data is re- 
ceived on a first channel of a cablte television 
network and said firmware packages aire captured 
from a second channel of the cable television net- 
work. 

40. The method of claim 39 comprising the 
further steps of: 

monitoring said first channel to receiwe converter 
control data; 

switching to said second channel to capture firm- 
ware upon receipt of appropriate instructions on 
said first channel; and 

switching back to said first channel after said firm- 
ware is captured. 

41. The method of claim 40 cormprising the 

further step of: 

switching back to said first channel frotm said sec- 
ond channel upon the expiration of a predeter- 
mined rime period, if the firmware has not been 
captured within said time period. 

42. The method of claim 41 cormprising the 
further step of: 

deriving said time period from converter control 
data received on said first channel. 

43. The method as defined in one <of claims 41 
or 42 wherein the length of the timie period is 
dependent on the amount of firmware) to be cap- 
tured. 

44. A remotely modifiable user terminal com- 
prising: 

means for receiving a plurality of cyclically trans- 
mitted firmware segments together comprising a 
firmware package; 

means coupled to said receiving means for verify- 
ing each segment upon receipt thereof;; 
means responsive to said verifying meians for stor- 
ing each verified segment; 

means for determining if a compiate firmware 
package has been stored in said storimg means at 
the completion of a firmware transmission cycle: 
means responsive to said determining means for 
continuing to receive, verify, and stor© transmitted 
firmware segments during a subsequent firmware 
transmission cycle if said determining means finds 
that a complete firmware package has not been 
stored; and 

means for terminating the reception of firmware 
segments upon a finding by said determining 
means that a complete firmware packaige has been 
stored. 

45. The terminal of claim 44 furthenr comprising: 
means for precluding the execution of firmware 
segments until a complete firmware [package has 
been stored. 

46. The terminal as defined in one of claims 44 
or 45 wherein said verifying means teists a check- 
sum for each firmware segment, said terminal fur- 
ther comprising: 



means for maintaining a record of tme proper chec- 
ksum for each segment; and 
means for periodically retesting s;aid checksums 
after a complete firmware package has been 
5 stored. 

47. The terminal of claim 46 furtther comprising: 
means for storing default operation software for 
said terminal; and 

means for executing said default operation software 
io if said checksums are not verified upon retesting. 

48. The terminal as defined ini one of claims 
44.47 further comprising: 

means for validating the complete firmware pack- 
age after it has been stored. 
75 49. The terminal of claim 48 furtther comprising: 

means for storing default operation software for 
said terminal; and 

means for executing said default operation software 
if said validating means determines that the com- 
20 plete firmware package is not valid. 

50. The terminal as defined irn one of claims 
44-49 further comprising: 

timer means for terminating the reception of firm- 
ware segments after a predetermined time period. 
25 51 . The terminal of claim 50 furtther comprising: 

means for storing default operation software for 
said terminal; and 

means for executing said default operation software 
if said timer means terminates trhe reception of 

30 firmware segments. 

52. The terminal as defined in one of claims 
44-51 wherein said terminal is a cable television 
converter, and the execution of saiid firmware pro- 
vides at least one converter function. 

35 53. The terminal as defined irn one of claims 

44-52 wherein a complete firmware package in- 
cludes a plurality of modules, said terminal further 
comprising: 

means for precluding the execution of downloaded 
40 firmware if fewer than all of the modules are avail- 
able for execution. 
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